Dashboards & Visualizations

Token referencing another token


Morning, Splunkers.

I've got a dashboard that gets some of it's input from an external link. The input that comes in determines which system is being displayed by the dashboard with different settings through a <change> line in each, then shows the necessary information in a line graph.

That part is working perfectly, but what I'm trying to do is set the color of the line graph based on the system chosen, and I'm trying to keep is simple for future edits.

I've set the colors I'm currently using in the <init> section as follows:


  <set token="red">0xFF3333</set>
  <set token="purple">0x8833FF</set>
  <set token="green">0x00FF00</set>


The system selection looks like this:


<input token="system" depends="$NotDisplayed$">
    <condition value="System-A">
      <set token="index_filter">index_A</set>
      <set token="display_name">System-A</set>
      <set token="color">$purple$</set>
    <condition value="System-B">
      <set token="index_filter">index_B</set>
      <set token="display_name">System-B</set>
      <set token="color">$green$</set>
      <condition value="System-C">
      <set token="index_filter">index_C</set>
      <set token="display_name">System-C</set>
      <set token="color">$red$</set>



I now have a single query window putting up a line graph with the necessary information brought in from the eternal link. Like I said above, that part works perfectly, but what DOESN'T work is the color. Here's what my option field currently looks like:


<option name="charting.fieldColors">{"MyField":$color$}</option>



The idea here is if I add future systems, I don't have to keep punching in hex codes for colors, I just enter a color name token. Unfortunately, what ends up happening is the line graph color is black, no matter what color I use. If I take the $color$ token out of the code and put in the hex code directly it works fine. It also works if I put the hex code directly in the system selection instead of the color name token.

Is there a trick to having a token reference another token in a dashboard? Or is this one of those "quit being fancy and do it the hard way" type of things?

Any help will be appreciated. Running Splunk 8.2.4, in case it matters.

Labels (2)
0 Karma


iirc this part of the SimpleXML is not re-evaluated after the dashboard is loaded, therefore the tokens can't be used here. iirc, the way approached this is to use CSS where tokens are evaluated. The trick with using CSS is identifying the element you want to change the style of so depending on how dynamic your charts are or how different they are for each system, this may prove to be quite tricky!


I was afraid of that. It's no big deal, I can hand-jam in the hex code for each system.

Thanks for the response!

0 Karma


Hey @A_VA,

Can you try wrapping the color token in quotes as "$red|s$". I believe this should work. 

Relevant document: https://docs.splunk.com/Documentation/Splunk/9.2.1/Viz/tokens#Syntax_to_consume_tokens





If the above solution helps, an upvote is appreciated.


Sadly, no, that didn't work. No biggie, I can hand-jam in the hex code for each system, I was just hoping to get a little too fancy.

Thanks, though!

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...